Unit 42: Chinese-speaking cluster CL-STA-1062 deploys the new TinyRCT .NET backdoor against SE-Asian government and energy targets via AppDomainManager injection
Palo Alto Unit 42 (2026-06-25) documented CL-STA-1062, a Chinese-speaking cluster overlapping with Cisco Talos's UAT-7237, targeting government and state-owned energy infrastructure across Southeast Asia (Unit 42, 2026-06-25; The Hacker News, 2026-06-26). Initial access is via internet-facing web apps and ASPX web shells (T1505.003), pivoting to a custom .NET backdoor, TinyRCT, delivered through AppDomainManager injection (T1574.014): a benign signed chrome_setup.exe ships in a ZIP alongside a malicious chrome_setup.exe.config, causing the .NET CLR to load MyAppDomainManager.dll from the same directory and bootstrap TinyRCT in-process — no child process, so it is low-visibility to EDR. TinyRCT beacons over HTTP with AES-128-CBC payloads, supports command execution via cmd.exe, chunked file exfiltration, and screen capture, and self-terminates unless run from %LOCALAPPDATA% or %USERPROFILE%\Downloads (anti-sandbox). Observed tooling includes Mimikatz, JuicyPotato and SoftEther VPN masqueraded as vmtools.exe. The defender value is the technique: T1574.014 AppDomainManager injection is widely under-detected, and the same web-shell-to-in-process-.NET pattern is directly applicable to European public-sector web estates. Hunt for .NET .config files written into user-writable directories adjacent to signed executables, and DLL loads of MyAppDomainManager.dll from a signed PE's own directory (Sysmon EID 7).
TinyRCT is a .NET-based RAT with capabilities including arbitrary command execution, file enumeration and exfiltration, screen capture, and self-destruct functionality. The malware communicates via HTTP with AES-128 encrypted payloads.
CL-STA-1062 represents a sustained, sophisticated threat targeting critical infrastructure across Asia-Pacific.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1574.014Hijack Execution Flow: AppDomainManager
Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.
Persistence TA0003
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Stealth TA0005
T1574.014Hijack Execution Flow: AppDomainManager
Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.